A redundant system has been proposed, having redundantly configured arithmetic devices for controlling, for example, a plant process to perform control so that the plant function is not lost even when some of the arithmetic devices fail.
Patent Literature 1 discloses a method of determining a control variable by a triplex control system including three redundant arithmetic devices, in which the intermediate value of three calculation results output from the respective arithmetic devices is determined to be a control variable when the three calculation results do not match, whereas high-value selection or low-value selection is performed when the triplex system is switched to a duplex system because one of the three arithmetic devices has stopped.